Multiple format string vulnerabilities in logging functions in mod_auth_pgsql before 2.0.3, when used for user authentication against a PostgreSQL database, allows remote unauthenticated attackers to execute arbitrary code, as demonstrated via the username.

iDEFENSE reports that a format string vulnerability in mod_auth_pgsql, a library used to authenticate web users against a PostgreSQL database, could be used to execute arbitrary code with the privileges of the httpd user.

Updated mod_auth_pgsql packages that fix format string security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The mod_auth_pgsql package is an httpd module that allows user authentication against information stored in a PostgreSQL database.

Several format string flaws were found in the way mod_auth_pgsql logs information. It may be possible for a remote attacker to execute arbitrary code as the 'apache' user if mod_auth_pgsql is used for user authentication. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-3656 to this issue.

Please note that this issue only affects servers which have mod_auth_pgsql installed and configured to perform user authentication against a PostgreSQL database.

All users of mod_auth_pgsql should upgrade to these updated packages, which contain a backported patch to resolve this issue.

This issue does not affect the mod_auth_pgsql package supplied with Red Hat Enterprise Linux 2.1.

Red Hat would like to thank iDefense for reporting this issue.

Several format string vulnerabilities were discovered in the error logging handling. By sending specially crafted user names, an unauthenticated remote attacker could exploit this to crash the Apache server or possibly even execute arbitrary code with the privileges of Apache (user 'www-data').

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

iDefense discovered several format string vulnerabilities in the way that mod_auth_pgsql logs information which could potentially be used by a remote attacker to execute arbitrary code as the apache user if mod_auth_pgsql is used for user authentication.

The provided packages have been patched to prevent this problem.

The remote host is affected by the vulnerability described in GLSA-200601-05 (mod_auth_pgsql: Multiple format string vulnerabilities)

    The error logging functions of mod_auth_pgsql fail to validate certain     strings before passing them to syslog, resulting in format string     vulnerabilities.
  Impact :

    An unauthenticated remote attacker could exploit these vulnerabilities     to execute arbitrary code with the rights of the user running the     Apache2 server by sending specially crafted login names.
  Workaround :

    There is no known workaround at this time.

Several format string flaws were found in the way mod_auth_pgsql logs information. It may be possible for a remote attacker to execute arbitrary code as the 'apache' user if mod_auth_pgsql is used for user authentication. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-3656 to this issue.

Please note that this issue only affects servers which have mod_auth_pgsql installed and configured to perform user authentication against a PostgreSQL database.

Red Hat would like to thank iDefense for reporting this issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2006:0164 advisory.

  - security flaw (CVE-2005-3656)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is running the Apache mod_auth_pgsql module, a module for authenticating remote users against a PostgreSQL database.  This version of mod_auth_pgsql is vulnerable to multiple format string flaws.  An attacker exploiting these flaws would be able to execute arbitrary code on the remote web server. 

ID	Name	Product	Family	Severity
22801	Debian DSA-935-1 : libapache2-mod-auth-pgsql - format string vulnerability	Nessus	Debian Local Security Checks	critical
21887	CentOS 3 / 4 : mod_auth_pgsql (CESA-2006:0164)	Nessus	CentOS Local Security Checks	critical
20786	Ubuntu 4.10 / 5.04 / 5.10 : libapache2-mod-auth-pgsql vulnerability (USN-239-1)	Nessus	Ubuntu Local Security Checks	critical
20475	Mandrake Linux Security Advisory : apache2-mod_auth_pgsql (MDKSA-2006:009)	Nessus	Mandriva Local Security Checks	critical
20415	GLSA-200601-05 : mod_auth_pgsql: Multiple format string vulnerabilities	Nessus	Gentoo Local Security Checks	critical
20405	Fedora Core 4 : mod_auth_pgsql-2.0.1-8.1 (2006-015)	Nessus	Fedora Local Security Checks	critical
20404	Fedora Core 3 : mod_auth_pgsql-2.0.1-6.2 (2006-014)	Nessus	Fedora Local Security Checks	critical
20399	RHEL 4 : mod_auth_pgsql (RHSA-2006:0164)	Nessus	Red Hat Local Security Checks	critical
3358	Apache < 2.0.3 mod_auth_pgsql Module Server Log Format String	Nessus Network Monitor	Web Servers	critical

Detections

Analytics

CVE-2005-3656

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical